Vulnerability Description
Gogs is an open source self-hosted Git service. Prior to 0.14.3, in new_form.tmpl, milestone names are rendered with Go's default auto-escaping ({{.Name}}), which converts < to < etc. This prevents direct HTML injection. However, when the browser renders the DOM, the text content of the element contains the decoded original payload. Semantic UI 2.4.2's dropdown component has preserveHTML: true as the default setting. When a user selects a dropdown item, the internal set.text() method calls jQuery's .html() with the item's text content. This re-parses the decoded text as HTML, creating the injected element and triggering the JavaScript event handler. An attacker can store an HTML/JavaScript payload in a milestone name, and when any user opens the New Issue page and interacts with the milestone dropdown, the payload executes in their browser via Semantic UI's preserveHTML behavior. This vulnerability is fixed in 0.14.3.
Related Weaknesses (CWE)
References
- https://github.com/gogs/gogs/commit/573eacdc658641487f8ad883da96b29ec8e2852d
- https://github.com/gogs/gogs/pull/8325
- https://github.com/gogs/gogs/releases/tag/v0.14.3
- https://github.com/gogs/gogs/security/advisories/GHSA-vcm5-gvmp-78mp
- https://github.com/gogs/gogs/security/advisories/GHSA-vcm5-gvmp-78mp
FAQ
What is CVE-2026-52807?
CVE-2026-52807 is a documented vulnerability. Gogs is an open source self-hosted Git service. Prior to 0.14.3, in new_form.tmpl, milestone names are rendered with Go's default auto-escaping ({{.Name}}), which converts < to < etc. This prevents...
How severe is CVE-2026-52807?
CVSS scoring is not yet available for CVE-2026-52807. Check NVD for updates.
Is there a patch for CVE-2026-52807?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.